Turla Hackers Use Cereal Malware Toolset to Exploit Microsoft Exchange Servers for Email Theft
Turla hackers use Cereal malware to steal emails from Microsoft Exchange servers.
The Russia-aligned Turla hacking group is utilizing a new malware toolset named Cereal to compromise Microsoft Exchange servers, transforming them into email collection systems. ESET Research discovered these attacks targeting government organizations in Kazakhstan and Romania, noting that the malware copies emails while allowing normal delivery, thus avoiding detection. The attackers specifically filtered messages involving NATO and EU addresses, indicating a focus on intelligence gathering.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ESET?
Get an email when a new story names ESET, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Turla group exploited Microsoft Exchange servers to deploy the Cereal malware toolset, which covertly copied emails while still delivering them normally to recipients — a design specifically intended to evade detection. Government organizations in Kazakhstan and Romania were targeted, with attackers filtering for NATO and EU-related communications, revealing a clear intelligence-collection motive. This incident highlights how undetected server-level compromise can expose sensitive diplomatic communications for extended periods. The ability to passively intercept email without disrupting delivery makes this threat particularly dangerous because standard user-facing monitoring will show no anomalies.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — nato.int
- domain — europa.eu